Support tls version

[drexler]

Fixes #236

Description of Issue Fixed
This adds a new paramater securityPolicy which allows for setting the TLS version to be used by the created custom domain.

custom:
  customDomain:
    securityPolicy: tls_1_0 | tls_1_2

[vt-cwalker]

Thanks for implementing this @drexler . I was looking for something like this as well. However, would it be better to default to the more secure TLS1.2 instead of TLS1.0? I know AWS defaults to TLS1.0 for more backwards compatibility, but just wondering what others thought about this as well.

Also in the documentation addition, it seems you put in tls_1_2 but in the code you default to tls_1_0. So may seem to users reading docs that it may default to tls_1_2.

[drexler]

@rts-cwalker i intentionally kept the default in line with AWS defaults. I think going forward that will prevent surprises when users install it. Also, the documentation update i did does specify tls_1_0 as the default.

[vt-cwalker]

@rts-cwalker i intentionally kept the default in line with AWS defaults. I think going forward that will prevent surprises when users install it. Also, the documentation update i did does specify tls_1_0 as the default.

@drexler Actually, looks like AWS defaults to TLS1.2 for any new custom APIGW domains now. I just tried created a new one via AWS console and it defaults to TLS1.2 now. Maybe this allows us to default to 1.2 now in this plugin as well?

[drexler]

@drexler Actually, looks like AWS defaults to TLS1.2 for any new custom APIGW domains now. I just tried created a new one via AWS console and it defaults to TLS1.2 now. Maybe this allows us to default to 1.2 now in this plugin as well?

@rts-cwalker good catch 👍 . You're right and i've updated my PR to now default to TLS v1.2

[vt-cwalker]

@drexler Cool looks good. Except does this line need to be changed as well? https://github.com/amplify-education/serverless-domain-manager/pull/240/files#diff-938360079f2a94b0aa5704b05ac404f5R18

[drexler]

@rts-cwalker oops. I'll address that.

[captainsidd]

Hey everyone - this looks good to me. Thanks again for taking the time to implement this feature. I'll go ahead and merge this PR.

[uccmen]

Hey guys, sorry to bring this up here now but what if I already created the domain previously and would like to update my securityPolicy to use 1.2?
based on the source code, the tls version is only applied during creation.

[uccmen]

Please ignore my above comment, just read the Known Issues section on README.